aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--ansible/roles/cinder/templates/cinder.conf.j212
-rw-r--r--ansible/roles/common/templates/kolla-toolbox.json.j242
-rw-r--r--ansible/roles/haproxy-config/templates/haproxy_single_service_split.cfg.j22
-rw-r--r--ansible/roles/horizon/defaults/main.yml10
-rw-r--r--ansible/roles/kolla_toolbox/handlers/main.yml4
-rw-r--r--ansible/roles/mariadb/tasks/copy-certs.yml10
-rw-r--r--ansible/roles/mariadb/templates/backup.my.cnf.j23
-rw-r--r--ansible/roles/mariadb/templates/mariabackup.json.j27
-rw-r--r--ansible/roles/prometheus/tasks/precheck.yml8
-rw-r--r--doc/source/reference/networking/neutron.rst8
-rw-r--r--releasenotes/notes/bug-2161971-1f167e47f9740326.yaml9
-rw-r--r--releasenotes/notes/fix_prometheus_vault_prechecks-5335880cd18680dd.yaml10
-rw-r--r--tests/pre.yml11
-rw-r--r--tests/templates/globals-default.j24
14 files changed, 84 insertions, 56 deletions
diff --git a/ansible/roles/cinder/templates/cinder.conf.j2 b/ansible/roles/cinder/templates/cinder.conf.j2
index 5e9fb5337..106091073 100644
--- a/ansible/roles/cinder/templates/cinder.conf.j2
+++ b/ansible/roles/cinder/templates/cinder.conf.j2
@@ -107,6 +107,18 @@ username = {{ nova_keystone_user }}
password = {{ nova_keystone_password }}
cafile = {{ openstack_cacert }}
+[glance]
+interface = internal
+auth_url = {{ keystone_internal_url }}
+auth_type = password
+project_domain_id = {{ default_project_domain_id }}
+user_domain_id = {{ default_user_domain_id }}
+region_name = {{ openstack_region_name }}
+project_name = service
+username = {{ cinder_keystone_user }}
+password = {{ cinder_keystone_password }}
+cafile = {{ openstack_cacert }}
+
[database]
connection = mysql+pymysql://{{ cinder_database_user }}:{{ cinder_database_password }}@{{ cinder_database_address }}/{{ cinder_database_name }}{{ '?ssl_ca=' ~ openstack_cacert if cinder_database_enable_tls_internal | bool }}
connection_recycle_time = {{ database_connection_recycle_time }}
diff --git a/ansible/roles/common/templates/kolla-toolbox.json.j2 b/ansible/roles/common/templates/kolla-toolbox.json.j2
deleted file mode 100644
index 366e3586b..000000000
--- a/ansible/roles/common/templates/kolla-toolbox.json.j2
+++ /dev/null
@@ -1,42 +0,0 @@
-{
- "command": "kolla_toolbox",
- "config_files": [
- {
- "source": "{{ container_config_directory }}/clouds.yaml",
- "dest": "/var/lib/ansible/.config/openstack/clouds.yaml",
- "owner": "ansible",
- "perm": "0600"
- }{% if enable_rabbitmq | bool %},
- {
- "source": "{{ container_config_directory }}/rabbitmq-erlang.cookie",
- "dest": "/var/lib/rabbitmq/.erlang.cookie",
- "owner": "rabbitmq",
- "perm": "0600"
- },
- {
- "source": "{{ container_config_directory }}/rabbitmq-env.conf",
- "dest": "/etc/rabbitmq/rabbitmq-env.conf",
- "owner": "rabbitmq",
- "perm": "0600"
- },
- {
- "source": "{{ container_config_directory }}/erl_inetrc",
- "dest": "/etc/rabbitmq/erl_inetrc",
- "owner": "rabbitmq",
- "perm": "0600"
- }{% endif %}{% if kolla_copy_ca_into_containers | bool %},
- {
- "source": "{{ container_config_directory }}/ca-certificates",
- "dest": "/var/lib/kolla/share/ca-certificates",
- "owner": "root",
- "perm": "0644"
- }{% endif %}
- ],
- "permissions": [
- {
- "path": "/var/log/kolla/ansible.log",
- "perm": "0664",
- "owner": "ansible:kolla"
- }
- ]
-}
diff --git a/ansible/roles/haproxy-config/templates/haproxy_single_service_split.cfg.j2 b/ansible/roles/haproxy-config/templates/haproxy_single_service_split.cfg.j2
index 10498e033..bae946b77 100644
--- a/ansible/roles/haproxy-config/templates/haproxy_single_service_split.cfg.j2
+++ b/ansible/roles/haproxy-config/templates/haproxy_single_service_split.cfg.j2
@@ -50,7 +50,7 @@ frontend {{ service_name }}_front
{{ "bind %s:%s %s" | e | format(vip_address, service_port, tls_option) | trim() }}
{# Redirect mode sets a redirect scheme instead of a backend #}
{% if service_mode == 'redirect' %}
-{% if enable_letsencrypt == 'yes' %}
+{% if enable_letsencrypt | bool %}
redirect scheme https code 301 if !{ ssl_fc } !{ path_reg ^/.well-known/acme-challenge/.+ }
{% else %}
redirect scheme https code 301 if !{ ssl_fc }
diff --git a/ansible/roles/horizon/defaults/main.yml b/ansible/roles/horizon/defaults/main.yml
index 04cd14761..9d7b66e01 100644
--- a/ansible/roles/horizon/defaults/main.yml
+++ b/ansible/roles/horizon/defaults/main.yml
@@ -34,7 +34,7 @@ horizon_services:
port: "{% if kolla_enable_tls_internal | bool %}{{ horizon_tls_port }}{% else %}{{ horizon_port }}{% endif %}"
listen_port: "{{ horizon_listen_port }}"
frontend_http_extra:
- - "{% if enable_letsencrypt == 'yes' %}use_backend acme_client_back if { path_reg ^/.well-known/acme-challenge/.+ }{% endif %}"
+ - "{% if enable_letsencrypt | bool %}use_backend acme_client_back if { path_reg ^/.well-known/acme-challenge/.+ }{% endif %}"
backend_http_extra:
- "balance {{ 'roundrobin' if enable_memcached | bool or horizon_backend_database | bool else 'source' }}"
- "option httpchk"
@@ -46,7 +46,7 @@ horizon_services:
port: "{{ horizon_port }}"
listen_port: "{{ horizon_listen_port }}"
frontend_redirect_extra:
- - "{% if enable_letsencrypt == 'yes' %}use_backend acme_client_back if { path_reg ^/.well-known/acme-challenge/.+ }{% endif %}"
+ - "{% if enable_letsencrypt | bool %}use_backend acme_client_back if { path_reg ^/.well-known/acme-challenge/.+ }{% endif %}"
horizon_external:
enabled: "{{ enable_horizon }}"
mode: "http"
@@ -55,7 +55,7 @@ horizon_services:
port: "{% if kolla_enable_tls_external | bool %}{{ horizon_tls_port }}{% else %}{{ horizon_port }}{% endif %}"
listen_port: "{{ horizon_listen_port }}"
frontend_http_extra:
- - "{% if enable_letsencrypt == 'yes' %}use_backend acme_client_back if { path_reg ^/.well-known/acme-challenge/.+ }{% endif %}"
+ - "{% if enable_letsencrypt | bool %}use_backend acme_client_back if { path_reg ^/.well-known/acme-challenge/.+ }{% endif %}"
backend_http_extra:
- "balance {{ 'roundrobin' if enable_memcached | bool or horizon_backend_database | bool else 'source' }}"
- "option httpchk"
@@ -68,9 +68,9 @@ horizon_services:
port: "{{ horizon_port }}"
listen_port: "{{ horizon_listen_port }}"
frontend_redirect_extra:
- - "{% if enable_letsencrypt == 'yes' %}use_backend acme_client_back if { path_reg ^/.well-known/acme-challenge/.+ }{% endif %}"
+ - "{% if enable_letsencrypt | bool %}use_backend acme_client_back if { path_reg ^/.well-known/acme-challenge/.+ }{% endif %}"
acme_client:
- enabled: "{{ enable_letsencrypt }}"
+ enabled: "{{ enable_letsencrypt | bool }}"
with_frontend: false
custom_member_list: "{{ acme_client_servers }}"
diff --git a/ansible/roles/kolla_toolbox/handlers/main.yml b/ansible/roles/kolla_toolbox/handlers/main.yml
index 73db9be9d..8acaece93 100644
--- a/ansible/roles/kolla_toolbox/handlers/main.yml
+++ b/ansible/roles/kolla_toolbox/handlers/main.yml
@@ -23,3 +23,7 @@
become: true
ansible.builtin.command: "{{ kolla_container_engine }} exec -t {{ service['container_name'] }} ansible --version"
changed_when: false
+ register: result
+ until: result.rc == 0
+ retries: 5
+ delay: 5
diff --git a/ansible/roles/mariadb/tasks/copy-certs.yml b/ansible/roles/mariadb/tasks/copy-certs.yml
index 1c385e6d1..368df9302 100644
--- a/ansible/roles/mariadb/tasks/copy-certs.yml
+++ b/ansible/roles/mariadb/tasks/copy-certs.yml
@@ -1,4 +1,14 @@
---
+- name: "Copy CA certificates for mariabackup"
+ become: true
+ ansible.builtin.copy:
+ src: "{{ kolla_certificates_dir }}/ca/"
+ dest: "{{ node_config_directory }}/mariabackup/ca-certificates"
+ mode: "0644"
+ when:
+ - enable_mariabackup | bool
+ - inventory_hostname == mariadb_backup_host
+
- name: "Copy certificates and keys for {{ project_name }}"
ansible.builtin.import_role:
role: service-cert-copy
diff --git a/ansible/roles/mariadb/templates/backup.my.cnf.j2 b/ansible/roles/mariadb/templates/backup.my.cnf.j2
index 8d1ae2593..30065f4bd 100644
--- a/ansible/roles/mariadb/templates/backup.my.cnf.j2
+++ b/ansible/roles/mariadb/templates/backup.my.cnf.j2
@@ -4,3 +4,6 @@ user={{ mariadb_backup_database_user }}
password={{ mariadb_backup_database_password }}
host={{ api_interface_address }}
port={{ mariadb_port }}
+{% if database_enable_tls_backend | bool %}
+ssl_ca=/etc/mariadb/certs/root.crt
+{% endif %}
diff --git a/ansible/roles/mariadb/templates/mariabackup.json.j2 b/ansible/roles/mariadb/templates/mariabackup.json.j2
index ff32de2b6..7444364a6 100644
--- a/ansible/roles/mariadb/templates/mariabackup.json.j2
+++ b/ansible/roles/mariadb/templates/mariabackup.json.j2
@@ -7,6 +7,13 @@
"owner": "mysql",
"perm": "0600"
}
+ {% if database_enable_tls_backend | bool %},
+ {
+ "source": "{{ container_config_directory }}/ca-certificates/root.crt",
+ "dest": "/etc/mariadb/certs/root.crt",
+ "owner": "mysql",
+ "perm": "0600"
+ }{% endif %}
],
"permissions": [
{
diff --git a/ansible/roles/prometheus/tasks/precheck.yml b/ansible/roles/prometheus/tasks/precheck.yml
index d4bdf0eba..5b98a09b4 100644
--- a/ansible/roles/prometheus/tasks/precheck.yml
+++ b/ansible/roles/prometheus/tasks/precheck.yml
@@ -28,21 +28,21 @@
ansible.builtin.assert:
that:
- prometheus_bcrypt_salt is defined
- - prometheus_bcrypt_salt is string
+ - prometheus_bcrypt_salt is string or prometheus_bcrypt_salt is vault_encrypted
- prometheus_bcrypt_salt | length == 22
- name: Check that prometheus_password is correctly set
ansible.builtin.assert:
that:
- prometheus_password is defined
- - prometheus_password is string
+ - prometheus_password is string or prometheus_password is vault_encrypted
- prometheus_password | length > 0
- name: Check that prometheus_grafana_password is correctly set
ansible.builtin.assert:
that:
- prometheus_grafana_password is defined
- - prometheus_grafana_password is string
+ - prometheus_grafana_password is string or prometheus_grafana_password is vault_encrypted
- prometheus_grafana_password | length > 0
when: enable_grafana | bool
@@ -50,7 +50,7 @@
ansible.builtin.assert:
that:
- prometheus_skyline_password is defined
- - prometheus_skyline_password is string
+ - prometheus_skyline_password is string or prometheus_skyline_password is vault_encrypted
- prometheus_skyline_password | length > 0
when: enable_skyline | bool
diff --git a/doc/source/reference/networking/neutron.rst b/doc/source/reference/networking/neutron.rst
index b4f7a884f..46b565ba8 100644
--- a/doc/source/reference/networking/neutron.rst
+++ b/doc/source/reference/networking/neutron.rst
@@ -25,10 +25,10 @@ value is ``eth1``. These external interfaces are used by hosts in the
``network`` group. They are also used by hosts in the ``compute`` group if
``enable_neutron_provider_networks`` is set or DVR is enabled.
-The external interfaces are each plugged into a bridge (Open vSwitch or Linux
-Bridge, depending on the driver) defined by ``neutron_bridge_name``, which
-defaults to ``br-ex``. When there are multiple external interfaces,
-``neutron_bridge_name`` should be a comma-separated list of the same length.
+The external interfaces are each plugged into an Open vSwitch bridge defined by
+``neutron_bridge_name``, which defaults to ``br-ex``. When there are multiple
+external interfaces, ``neutron_bridge_name`` should be a comma-separated list
+of the same length.
The default Neutron physical network is ``physnet1``, or ``physnet1`` to
``physnetN`` when there are multiple external network interfaces. This may be
diff --git a/releasenotes/notes/bug-2161971-1f167e47f9740326.yaml b/releasenotes/notes/bug-2161971-1f167e47f9740326.yaml
new file mode 100644
index 000000000..e57a8a0bf
--- /dev/null
+++ b/releasenotes/notes/bug-2161971-1f167e47f9740326.yaml
@@ -0,0 +1,9 @@
+---
+fixes:
+ - |
+ Fixes service-to-service authentication between Cinder and
+ Glance. This resolves ``HTTP 403 Forbidden`` errors during
+ ``fetch_image_location`` and restores fast volume cloning
+ (Copy-on-Write) for backends like RBD, preventing an
+ unnecessary fallback to slow image downloads.
+ `LP#2161971 <https://launchpad.net/bugs/2161971>`__
diff --git a/releasenotes/notes/fix_prometheus_vault_prechecks-5335880cd18680dd.yaml b/releasenotes/notes/fix_prometheus_vault_prechecks-5335880cd18680dd.yaml
new file mode 100644
index 000000000..8a6bc53a9
--- /dev/null
+++ b/releasenotes/notes/fix_prometheus_vault_prechecks-5335880cd18680dd.yaml
@@ -0,0 +1,10 @@
+---
+fixes:
+ - |
+ Fixes Prometheus precheck failing on ``prometheus_bcrypt_salt``,
+ ``prometheus_password``, ``prometheus_grafana_password`` and
+ ``prometheus_skyline_password`` when these are Ansible Vault encrypted
+ values, due to a known Ansible limitation where the ``is string`` Jinja
+ test does not recognise vault-encrypted strings. See
+ `ansible/ansible#33067 <https://github.com/ansible/ansible/issues/33067>`__
+ for details.
diff --git a/tests/pre.yml b/tests/pre.yml
index a8c17bbcd..be8df89b9 100644
--- a/tests/pre.yml
+++ b/tests/pre.yml
@@ -65,6 +65,17 @@
state: present
when: ansible_facts.distribution == "Rocky"
+ # TODO(mnasiadka): prefer IPv4 over IPv6 in getaddrinfo() to avoid
+ # slow/failing AAAA lookups against hosts without real IPv6
+ # connectivity. Remove once IPv6 in VexxHost ca-ymq-1 is reliable.
+ - name: Prefer IPv4 over IPv6 for name resolution
+ become: true
+ ansible.builtin.lineinfile:
+ path: /etc/gai.conf
+ line: "precedence ::ffff:0:0/96 100"
+ create: true
+ when: nodepool.region == 'ca-ymq-1'
+
# NOTE(yoctozepto): we use gawk to add time to each logged line
# outside of Ansible (e.g. for init-runonce)
- name: Install gawk and required Python modules
diff --git a/tests/templates/globals-default.j2 b/tests/templates/globals-default.j2
index 1a0d1a01c..867b67aba 100644
--- a/tests/templates/globals-default.j2
+++ b/tests/templates/globals-default.j2
@@ -11,8 +11,12 @@ network_address_family: "{{ address_family }}"
kolla_container_engine: "{{ container_engine }}"
docker_restart_policy: "no"
+# TODO(bbezak): Drop the condition once the mirror in VexxHost ca-ymq-1 is
+# reliable.
+{% if nodepool.region != 'ca-ymq-1' %}
docker_apt_url: "http://{{ zuul_site_mirror_fqdn }}:8080/docker/{{ ansible_facts.distribution | lower }}"
docker_yum_url: "http://{{ zuul_site_mirror_fqdn }}:8080/docker/centos"
+{% endif %}
{% if container_engine == 'podman' %}
podman_debug: true
generated by cgit v1.2.3 (git 2.39.1) at 2026-11-05 14:52:34 +0000